Suspicious PowerShell Mailbox SMTP Forward Rule

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•18

Detects the usage of the PowerShell `Set-Mailbox` cmdlet to configure an SMTP forwarding rule for a mailbox. This can be indicative of an adversary setting up automatic email forwarding to an external address for data exfiltration or continued access to communications.